311274148536bed431d735389559bbf56898e2dcda54578a4b1c94ad655c55de

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf3f6ce0cb87cb5a3f7cf80619fb3440_JaffaCakes118.html
Size

130KB
MD5

bf3f6ce0cb87cb5a3f7cf80619fb3440
SHA1

bf249bae2a23681286951c8a8879d78e76460d7d
SHA256

311274148536bed431d735389559bbf56898e2dcda54578a4b1c94ad655c55de
SHA512

07c01ba9568a9614adf706d06ff83be5b6b8e546e408f38aaa994a9989bcc3f70618c02113874e8b4879475d9092e6745166d9df6d4747e6db0f2c35bedb21e3
SSDEEP

1536:SEu9IMyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dJ:SECbyfkMY+BES09JXAnyrZalI+YL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000ea508913cd85f88788db442faf2a54b26a96d4ad52c957083bf2665c362dca8b000000000e80000000020000200000009d72492f82d283ec4ef3058ce32abcdec9bb18022117e3d3e1cf6da5d378097220000000f4c0405db5c494a84ecba0b83f0cfa8ca7bd259044f89ff4e64c7f19d19011424000000022f13626d18df65082fb457752e289b95730c428443008cdf6071efba3c5d62abdbe6a1f78b1479296ffb1c610d8c3ae11a41f5f8834f685486f76dc38017b44	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9ED1BF61-624E-11EF-AC25-4298DBAE743E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000224be8e4d21e8d134b990e404c4b0d5884daf70f157614e9223c5a2f38b94d2e000000000e8000000002000020000000decd3f02a87997104200df4d5b54e6319d26a8d50a274016fa681a0927c0dbb6900000003c131cfb8e3b6497493a0326a8fedf7d8f0d9863637fda2b37d8bacaf26ac77677bf6a2f8ae38de4a02e55f7cbb4886e32abff81d500da40446ff5669edbec9bf66e50eaeedd28436e59b1df8cd85f78e82212218f244c4b784ba2db6110683fdaeaa6678c0345745e94d980b8d8c05a2f7959905f6d104ffaab7e73fb8fbd9b4b4fc423c167252eac94141ff371941e400000009e7b5e94d63c9bfce0ccfd4b9187468c1872f6825d6c95556a5363de42501143c2e0f9828971cd7be187c30a6a5bc2df95be6bb72cc6007a10fc4638c5309ace	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430689398"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c6d2b45bf6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2224	2268	iexplore.exe	29
PID 2268 wrote to memory of 2224	2268	iexplore.exe	29
PID 2268 wrote to memory of 2224	2268	iexplore.exe	29
PID 2268 wrote to memory of 2224	2268	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf3f6ce0cb87cb5a3f7cf80619fb3440_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae76a6d05476999aeb813d9595dde04c

SHA1
a5224c96ca2e782828580284a6978e655dd8a597

SHA256
b99966f0d3da7fb8ae3499b628965ecf05f8fb5fd5ab2149879d97f864c2629b

SHA512
8d7a64f455badccde9fb2e23fc4735d09607f4f0879a3460376502a85914315d4baa2c7ae2dd2a95052958fc570efaa4003ebe3e8e595e7cf01d4b6f282be6e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bb6d3a06fea177907e8cce0a61e2c13

SHA1
88b7536fb8aead1d811b5fe1507b92d645ba80cf

SHA256
0b5b6d3b9df3a45305479e3935c65fdc40f84d0943899e45cf54c70c0cdee785

SHA512
69d570560b124ba60d20013df2cc28143dbcabbb46e31e06c8f74a53350291b2cec520f0d499a1cff85c5896431e374abc53721c90fc28f863c27881be608ff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea231fb4c67988dfcef7baef3d111ebb

SHA1
e55b66a10db1578fc579fc98ee9f52ed973f50c6

SHA256
ac59b8b99e3cf04746fb3954e69ed6335ccaea808c88ef09c5cee8b3adeea840

SHA512
a73683d27c5f07245f6413191f05e61e2b283afafd52203484817ac9cadbfb9e844c45d08147b6711d90e05e61e4b97b389120ab5eadd9ef9cf88d6af495445e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdd748c022a08b10a7f8e53d3b081b5b

SHA1
8cae76fb79b9bc41f550ae4a035d213967df7761

SHA256
668594f4a2065373a47824e6b7d0f542a100b92f15f40b21a1681fe314c788f4

SHA512
28db5f501a15712b921695b30d68f46a3545d2db0e82c16521bb63e7123b9d3a4fe64e070ff774c50969828fe3ea9a1fffe79ff4f4933d31ea32a8d6482343f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ec9a3a3fda49dcfdfcb07a181c60b1a

SHA1
77693770c5c91a6f7f3cf1865632682948f14525

SHA256
933eb8330bd7011514fe330e0b2e9762351aed727de9d56af5b0170e152acdfd

SHA512
684091f14c919ff362e1e90d8860e6b5b8e6eb840d32993b0172da344053dd5b52822ead9536cd68bdd02ecebf7cdac70b5281eccc0e728bc6f3efc6ee697da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5edff35a679d06dc98bdd6c180960b98

SHA1
66dea25dedf74bcc2cc925f0809ab4c32cf5cfa6

SHA256
89d92870ca0641191b963872657787fc6a9fef02085b7b718b1c9999b1192ae8

SHA512
a8992fc12e29ab734892d57f9e6e03fe4075906c1aee529826c15894d1d69fa0b8bcf1b89a3b8653eb20132e28b3a882b231d3767b0d2ecea5aac9a30150ab4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab234.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar247.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit